CVE-2026-19336 Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversal

A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access...

CVE-2026-19336

Pimzino spec-workflow-mcp (up to 2.2.6) contains a path traversal vulnerability in ApprovalStorage.createApproval (src/tools/approvals.ts) triggered by manipulating categoryName. Exploitation requires local access. A fix is available in version 2.2.7; the patch is tracked as 9c7a7839e690bb4543f0e...

EUVD-2025-31432

Malicious code in bioql PyPI...

CVE-2025-11068

A vulnerability was found in westboy CicadasCMS 1.0. Affected by this vulnerability is an unknown functionality of the file /system/cms/category/save. The manipulation of the argument categoryName results in cross site scripting. The attack can be executed remotely. The exploit has been made publ...

CVE-2025-11068 westboy CicadasCMS save cross site scripting

A vulnerability was found in westboy CicadasCMS 1.0. Affected by this vulnerability is an unknown functionality of the file /system/cms/category/save. The manipulation of the argument categoryName results in cross site scripting. The attack can be executed remotely. The exploit has been made publ...

CVE-2025-11068: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in westboy CicadasCMS 1.0. Affected by this vulnerability is an unknown functionality of the file /system/cms/category/save. The manipulation of the argument categoryName results in cross site scripting. The attack can be executed remotely. The exploit has been made publ...

CVE-2025-57150

phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting XSS in admin/subcategory.php via the categoryName parameter...

CVE-2025-57150: Improper Neutralization of Input During Web Page Generation

phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting XSS in admin/subcategory.php via the categoryName parameter...

CVE-2025-57150

The phpgurukul Complaint Management System in PHP 2.0 is vulnerable to a Cross-Site Scripting (XSS) issue in the admin/subcategory.php file. This vulnerability is caused by a lack of effective filtering and escaping of user-supplied data provided via the categoryName parameter. An attacker could ...

CVE-2025-8740: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0. It has been classified as problematic. Affected is an unknown function of the file /admin/categories/save of the component Category Handler. The manipulation of the argument categoryName leads to cross site scripting. It is possible to...

Apartment Visitors Management System category.php File Cross-Site Scripting Vulnerability

Apartment Visitors Management System is an apartment visitor management system. Apartment Visitors Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter categoryname in the file...

CVE-2025-7818

A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /category.php of the component HTTP POST Request Handler. The manipulation of the argument categoryname leads to cross...

CVE-2025-7818: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /category.php of the component HTTP POST Request Handler. The manipulation of the argument categoryname leads to cross...

CVE-2025-4505

A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /category.php. The manipulation of the argument categoryname leads to sql injection. The attack can be launche...

CVE-2025-4505: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /category.php. The manipulation of the argument categoryname leads to sql injection. The attack can be launche...

PHPGurukul Apartment Visitors Management System 注入漏洞

PHPGurukul Apartment Visitors Management System is an apartment visitor management system from PHPGurukul. An injection vulnerability exists in version 1.0 of the PHPGurukul Apartment Visitors Management System, which originates from a SQL injection due to incorrect manipulation of the categoryna...

CVE-2025-2352

A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /admin/indexConfigs/save of the component Backend. The manipulation of the argument categoryName leads to cross site scripting. The attack may...

CVE-2025-2352: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /admin/indexConfigs/save of the component Backend. The manipulation of the argument categoryName leads to cross site scripting. The attack may...

CVE-2025-1114: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/save of the component Add Category Page. The manipulation of the argument categoryName leads to cross site scripting. It is possible to launch the attack...

CVE-2025-0400

A vulnerability was found in StarSea99 starsea-mall 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/categories/update. The manipulation of the argument categoryName leads to cross site scripting. The attack may be initiated remotely. The exploi...